torusguard 1.3.5 → 1.4.0

package/skills/torusguard/payload/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 1.3.5
+version: 1.3.6
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write, run_command
 scripts-binding:

package/skills/torusguard/payload/workflows/apply.md

@@ -1,7 +1,7 @@
 ---
 description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 tools: Read, Grep, Glob, Bash, Edit, Write
-version: 1.3.5
+version: 1.4.0
 agent: remediator
 lifecycle-phase: Phase 5 (Patch Application)
 required-skills:
@@ -22,6 +22,14 @@ $ARGUMENTS
 ## Objective
 Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
 
+Supported CLI flags:
+- `npx torusguard apply [--target <dir>]` : Apply candidate patches with confirmation prompt
+- `npx torusguard apply --diff` : Preview unified diffs without modifying files on disk
+- `npx torusguard apply --selective` : Interactively review and approve patches one by one
+- `npx torusguard apply --verify` : Trigger immediate differential AST recheck post-apply
+- `npx torusguard apply --list-snapshots` : List available historical pre-apply backup snapshots
+- `npx torusguard apply --yes` / `-y` : Non-interactive auto-approval mode
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/audit.md

@@ -1,7 +1,7 @@
 ---
 description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.4.0
 agent: auditor
 lifecycle-phase: Phase 2 (Static Audit & Clustering)
 required-skills:
@@ -20,7 +20,13 @@ $ARGUMENTS
 ---
 
 ## Objective
-Static security AST scanning, stable fingerprinting, root-cause clustering, and 0-100 scoring.
+Static security AST scanning, stable fingerprinting, root-cause clustering, throughput telemetry, and 0-100 scoring.
+
+Supported CLI flags:
+- `npx torusguard audit [--target <dir>]` : Specify project root directory
+- `npx torusguard audit --watch` / `-w` : Continuous watch mode, re-scanning on file change
+- `npx torusguard audit --sarif` : Automatically export OASIS SARIF v2.1.0 log
+- `npx torusguard audit --severity <critical|high|medium|low>` : Floor filter for findings
 
 ---
 

package/skills/torusguard/payload/workflows/authorize.md

@@ -1,7 +1,7 @@
 ---
 description: Legal scope definition, target ownership proof verification, and safety boundary enforcement for runtime validation.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Phase 1 (Authorization Gate)
 required-skills:

package/skills/torusguard/payload/workflows/exploit-check.md

@@ -1,7 +1,7 @@
 ---
 description: Safe, bounded, single-step exploitability confirmation across 5 standard verification statuses.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: validator
 lifecycle-phase: Phase 3c (Exploitability Check)
 required-skills:

package/skills/torusguard/payload/workflows/harden.md

@@ -1,7 +1,7 @@
 ---
 description: Governed remediation formulation under strict Ponytail Protocol bounds (<= 35 additions, <= 25 deletions) and bundle packaging.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.4.0
 agent: remediator
 lifecycle-phase: Phase 4 (Remediation Formulation)
 required-skills:
@@ -22,6 +22,11 @@ $ARGUMENTS
 ## Objective
 Governed remediation formulation under strict Ponytail Protocol bounds (<=35 add, <=25 del).
 
+Supported CLI flags:
+- `npx torusguard harden [--target <dir>]` : Specify project root directory
+- `npx torusguard harden --dry-run` : Preview candidate patches without modifying disk files
+- `npx torusguard harden --severity <critical|high|medium|low>` : Filter findings by minimum severity floor
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/init.md

@@ -1,7 +1,7 @@
 ---
 description: Baseline project discovery, workspace scaffolding, stack detection, and framework-tailored security rule activation.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.4.0
 agent: profiler
 lifecycle-phase: Phase 0 (Baseline Setup)
 required-skills:
@@ -20,6 +20,12 @@ $ARGUMENTS
 ## Objective
 Baseline project discovery, workspace scaffolding, stack detection, and security rule activation.
 
+Supported CLI flags:
+- `npx torusguard init [--target <dir>]` : Scaffold workspace into specified root directory
+- `npx torusguard init --template <golang|nextjs|fastapi|express|django|react>` : Guide stack configuration explicitly
+- `npx torusguard init --audit` : Run immediate baseline audit post-initialization
+- `npx torusguard init --force` : Force overwrite existing workspace and re-scaffold baseline
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/memory.md

@@ -1,7 +1,7 @@
 ---
 description: TorusGuard Adaptive Security Memory Engine — view memory stats, export/import intelligence, apply TTL decay, and manage false positives.
 tools: Read, Grep, Glob, Bash
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Intelligence / Memory
 required-skills:

package/skills/torusguard/payload/workflows/recheck.md

@@ -1,7 +1,7 @@
 ---
 description: Targeted differential AST re-scan, fix closure verification, and regression state machine transitions.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 1.3.6
 agent: reviewer
 lifecycle-phase: Phase 6 (Targeted Recheck & Verification)
 required-skills:

package/skills/torusguard/payload/workflows/recipes.md

@@ -0,0 +1,55 @@
+---
+description: Explore, search, export, and project distilled Golden Fix Recipes in persistent security memory.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: remediator
+lifecycle-phase: Phase 6 (Memory & Recipes)
+required-skills:
+  - torusguard-recipes
+scripts-binding:
+  - .torusguard/scripts/recipes_runner.py
+  - .torusguard/scripts/memory_engine.py
+---
+
+# /torusguard recipes — Golden Fix Recipe Explorer & Memory Distillation
+
+$ARGUMENTS
+
+---
+
+## Objective
+Inspect, search, export, and project reusable, verified Ponytail remediation code snippets distilled from passing security patches and persistent memory patterns.
+
+---
+
+## Command Flags & Arguments
+
+| Mode | Command Syntax | Description |
+| :--- | :--- | :--- |
+| **List Recipes** | `npx torusguard recipes` | List all distilled golden fix recipes with verification counts and churn |
+| **Search Filter** | `npx torusguard recipes --search <query>` | Filter recipes by keyword, rule family (e.g. `TG-SEC`), or language |
+| **Inspect Detail** | `npx torusguard recipes --detail <id>` | View complete unified diff snippet for a specific recipe |
+| **Export Catalog** | `npx torusguard recipes --export <file>` | Export recipes to `.json` or `.md` catalog format |
+| **Apply Preview** | `npx torusguard recipes --apply <id>` | Project recipe diff onto codebase for manual review |
+| **Target Directory** | `npx torusguard recipes --target <dir>` | Specify custom project root directory |
+
+---
+
+## Execution Steps
+
+1. **Query Memory Patterns:** Read `.torusguard/memory/patterns.json` for verified `golden_fix_recipe` entries.
+2. **Apply Filter / Search:** Match `--search` query against rule IDs, titles, diffs, and target file types.
+3. **Render 75-Column Cards:** Format recipe cards showing verified counts, rule family, and Ponytail additions/deletions.
+4. **Export / Apply:** If requested, write export file or render projected patch snippet.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🛡️ TorusGuard Golden Fix Recipes
+- **Total Distilled:** [Count] verified recipes
+- **Filter:** [Query or None]
+- **Ponytail Bounds:** All recipes strictly <= 35 additions, <= 25 deletions
+- **Storage:** `.torusguard/memory/patterns.json`
+```

package/skills/torusguard/payload/workflows/report.md

@@ -1,7 +1,7 @@
 ---
-description: Executive posture reporting, cluster analysis, signed compliance audit, and OASIS SARIF v2.1.0 structured export.
+description: Executive posture reporting, interactive HTML dashboard generation, directory attack surface heatmap, and OASIS SARIF v2.1.0 structured export.
 tools: Read, Grep, Glob, Bash, Write
-version: 1.3.5
+version: 2.2.0
 agent: reviewer
 lifecycle-phase: Phase 7 (Reporting & SARIF Export)
 required-skills:
@@ -11,91 +11,95 @@ scripts-binding:
   - .torusguard/scripts/report_sync.py
   - .torusguard/scripts/sarif_exporter.py
   - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
 ---
 
-# /torusguard report — Unified Security Posture Report & SARIF Export
+# /torusguard report — Unified Security Posture Report & SARIF / HTML Export
 
 $ARGUMENTS
 
 ---
 
 ## Objective
-Executive posture reporting, cluster analysis, signed compliance audit, and SARIF v2.1.0 export.
+Generate an executive security posture report, interactive dark-mode HTML dashboard (`report.html`), and schema-compliant OASIS SARIF v2.1.0 log (`results.sarif`) with zero network dependencies.
 
 ---
 
-## Mandatory Pre-Flight Context Inspection
+## Dual Mode Execution Syntax
 
-Inspect run records and reporting parameters before generating release artifacts:
-1. **Active Run Records:** Ensure target run folder contains `findings.json` or `findings.md`.
-2. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard.
-3. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collision.
-4. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report.
-5. **Role Boundary:** Enforce reviewer agent sign-off before archiving run results.
+| Target Artifact | Mode A: Terminal CLI | Mode B: AI Chat Slash Command | Output Location |
+| :--- | :--- | :--- | :--- |
+| **Interactive HTML Dashboard** | `npx torusguard report --html` | `/torusguard report --html` or `/torusguard-report` | `report.html` (workspace root) + `.torusguard/runs/report-latest.html` |
+| **OASIS SARIF v2.1.0 Log** | `npx torusguard report --sarif` | `/torusguard report --sarif` | `.torusguard/runs/results-latest.sarif` |
+| **Combined (Both)** | `npx torusguard report --html --sarif` | `/torusguard report --html --sarif` | Both `report.html` and `results-latest.sarif` in a single pass |
+| **Custom Path** | `npx torusguard report --html --out <path>` | `/torusguard report --out <path>` | Specified path + latest run mirror |
+| **Monorepo Subproject** | `npx torusguard report --target <dir> --html` | `/torusguard report --target <dir>` | `<dir>/report.html` |
 
 ---
 
-## When to Use /torusguard report
-
-| Trigger Scenario | Recommended Action |
-| :--- | :--- |
-| Concluding a security review cycle or audit milestone | Run `/torusguard report` |
-| Exporting SARIF v2.1.0 logs for GitHub Code Scanning | Run `/torusguard report` |
-| Sharing executive posture summaries with stakeholders | Run `/torusguard report` |
-| Applying code modifications | Run `/torusguard apply` |
-| Re-checking modified files | Run `/torusguard recheck` |
-
----
-
-## Living Report Invariant
-- Executive posture reports incorporate health scoring and metrics from `security_report.md`.
-- Emits visual dark-mode HTML (`--html`) and OASIS SARIF v2.1.0 (`--sarif`).
-
-## Execution Steps
+## Mandatory Pre-Flight Context Inspection
 
-1. **Aggregate Lifecycle Data:** Load all finding cards, verification traces, and recheck logs.
-2. **Export OASIS SARIF v2.1.0:**
-   ```bash
-   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
-   ```
-3. **Compile Executive Markdown Report:** Generate `report.md` with executive summary, posture score, and metrics.
-4. **Sign Off Run Manifest:** Update `.torusguard/runs/<run_id>/manifest.json` with final status counts.
-5. **Archive Results:** Confirm artifacts (`report.md`, `results.sarif`, `summary.md`) are saved on disk.
+Inspect run records and reporting parameters before generating release artifacts:
+1. **Active Run Records:** Ensure target run folder or `.torusguard/runs/` contains valid run records.
+2. **Dual-Ledger Ground Truth:** Confirm that `security_report.md` at workspace root is in lockstep with findings.
+3. **SARIF v2.1.0 Schema:** Validate output structure against official OASIS SARIF standard (`sarif-schema-2.1.0.json`).
+4. **Multi-Analysis Category:** Tag static findings under category `torusguard/static` to prevent CI collisions.
+5. **Zero External CDN:** Ensure all icons, gauges, and scripts in `report.html` are 100% self-contained and offline-ready.
+6. **Secret Masking:** Ensure zero unredacted authorization tokens or API keys appear in report text.
 
 ---
 
-## Failure Recovery
+## Interactive Dashboard Features (v2.2.0)
 
-- **SARIF Schema Error:** Re-run `sarif_exporter.py` with schema validation flag to locate invalid properties.
-- **Empty Findings List:** Emit valid clean report indicating zero security vulnerabilities detected.
-- **Missing Run Folder:** Point script to latest valid timestamped run in `.torusguard/runs/`.
-- **Halt Trigger:** Abort if unredacted private secrets are detected in output text.
+When viewing `report.html` in any browser:
+1. **Safe Defenses vs Harmed Exposure:** Complete Defended Invariants inventory across all 74 rules in 18 architectural families. Clean codebases earn 100/100 (74 Defended, 0 Harmed).
+2. **Directory Attack Surface Heatmap:** Visual directory tree of exposure risk. Clicking any directory card filters the findings table to that specific folder.
+3. **Golden Recipe Explorer:** Distilled, verified fix patterns with before/after code templates and one-click clipboard copying.
+4. **Prescriptive Next Best Defenses:** Stack-aware security recommendations with copyable `npx torusguard harden` commands.
+5. **Client-Side Exporters:** Zero-network buttons to download OASIS SARIF v2.1.0 and CSV records directly from browser memory.
+6. **Multi-Agent AI Prompt Presets:** One-click prompts tailored for Cursor (`.cursorrules`), Claude Code (`CLAUDE.md`), Antigravity, and GitHub Copilot.
+7. **Print & PDF Styling:** Built-in high-contrast `@media print` layout for boardroom and compliance distribution.
 
 ---
 
-## Hallucination Guard
+## Execution Steps
 
-- ❌ Never invent vulnerability counts not backed by actual findings in the run ledger.
-- ❌ Never generate invalid SARIF JSON with missing physical location URIs.
-- ✅ Always export standard-compliant SARIF v2.1.0 with AST line fingerprints.
+1. **Detect Mode & Arguments:**
+   - Parse `--html`, `--sarif`, `--out`, `--target`, and `--run` from `$ARGUMENTS`.
+   - If no format flag is specified in chat, default to generating the visual HTML dashboard (`report.html`).
+2. **Execute Reporter Scripts:**
+   - **For SARIF:**
+     ```bash
+     python .torusguard/scripts/sarif_exporter.py [--output <path>] [--root <target>]
+     ```
+   - **For HTML:**
+     ```bash
+     python .torusguard/scripts/html_reporter.py [--out <path>] [--root <target>]
+     ```
+3. **Synchronize Dual Ledger:**
+   - Verify `security_report.md` matches `report.html` findings and posture score.
+4. **Emit 75-Column Visual Summary Card:**
+   - Present markdown output card with direct clickable links to both `report.html` and `security_report.md`.
 
 ---
 
 ## Output Card Format
 
 ```markdown
-### 📊 TorusGuard Security Posture Report
-- **Run ID:** `run-YYYYMMDD-HHMMSS`
-- **Total Findings:** [Count] ([Fixed] Fixed, [Open] Open)
-- **Security Posture Score:** [Score]/100
-- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif`
-- **Executive Report:** `.torusguard/runs/<run_id>/report.md`
-- **Status:** COMPLETE — report published
+### 🛡️ TorusGuard Security Posture Report Emitted
+- **Posture Score:** [Score]/100 ([Status Label])
+- **Invariants Defended:** [N] Defended · [M] Harmed (74 Rules)
+- **Living Ledger:** [security_report.md](file:///path/to/security_report.md)
+- **HTML Dashboard:** [report.html](file:///path/to/report.html)
+- **SARIF v2.1.0 Export:** [results-latest.sarif](file:///path/to/results-latest.sarif)
+- **Status:** COMPLETE — dual-ledger synchronized
 ```
 
 ---
 
-## Next Steps
+## Failure Recovery
 
-1. Upload `results.sarif` to GitHub Code Scanning via `.github/workflows/`.
-2. Share `report.md` with engineering stakeholders and project maintainers.
+- **Missing Run Folder:** Auto-discover the latest timestamped run in `.torusguard/runs/`.
+- **Windows File Lock:** `html_reporter.py` uses atomic temporary write swapping with exponential retry.
+- **Missing SARIF Input:** Auto-discovers findings from the latest audit run in `.torusguard/runs/`.
+- **Clean Workspace:** Emits 100/100 posture score with all 74 defended invariants listed.

package/skills/torusguard/payload/workflows/status.md

@@ -1,7 +1,7 @@
 ---
 description: Read-only diagnostic overview of workspace security posture, active configuration, rules catalog, and run history.
 tools: Read, Grep, Glob, Bash
-version: 1.3.5
+version: 1.4.0
 agent: reviewer
 lifecycle-phase: System / Diagnostics
 required-skills:
@@ -20,6 +20,9 @@ $ARGUMENTS
 ## Objective
 Read-only diagnostic overview of workspace security posture, active configuration, and run history.
 
+Supported CLI flags:
+- `npx torusguard status [--target <dir>]` : Diagnostic check on specified project directory
+
 ---
 
 ## Mandatory Pre-Flight Context Inspection

package/skills/torusguard/payload/workflows/torusguard-apply.md

@@ -0,0 +1,110 @@
+---
+description: Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 1.4.0
+agent: remediator
+lifecycle-phase: Phase 5 (Patch Application)
+required-skills:
+  - torusguard-apply
+scripts-binding:
+  - .torusguard/scripts/apply_runner.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# /torusguard apply — Governed Patch Application & Rollback Snapshot
+
+$ARGUMENTS
+
+---
+
+## Objective
+Governed patch application with pre-apply rollback snapshots and Human Gate authorization.
+
+Supported CLI flags:
+- `npx torusguard apply [--target <dir>]` : Apply candidate patches with confirmation prompt
+- `npx torusguard apply --diff` : Preview unified diffs without modifying files on disk
+- `npx torusguard apply --selective` : Interactively review and approve patches one by one
+- `npx torusguard apply --verify` : Trigger immediate differential AST recheck post-apply
+- `npx torusguard apply --list-snapshots` : List available historical pre-apply backup snapshots
+- `npx torusguard apply --yes` / `-y` : Non-interactive auto-approval mode
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect bundle validity and file safety before modifying disk code:
+1. **Bundle Verification:** Assert `patch.diff` exists in active run's remediation folder.
+2. **Pre-Apply Snapshot:** Save a byte-for-byte backup copy (`.bak` or `.torusguard/snapshots/<run_id>/`) prior to editing.
+3. **Uncommitted Changes:** Check git status; ensure target file has clean baseline.
+4. **Ponytail Check:** Re-verify that patch additions $\le 35$ and deletions $\le 25$.
+5. **Human Gate:** Confirm operator approval before committing edits to disk.
+6. **Workspace Cleanliness:** Verify git working tree has no uncommitted merge conflicts.
+7. **Execution Privilege:** Verify write access to targeted file locations.
+
+---
+
+## When to Use /torusguard apply
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Applying an approved remediation patch to disk | Run `/torusguard apply` |
+| Generating patch diff without modifying disk | Run `/torusguard harden` |
+| Verifying that patch eliminated flaw without regression | Run `/torusguard recheck` |
+| Reverting an applied patch | Restore from `.bak` snapshot |
+| Checking workspace status | Run `/torusguard status` |
+
+---
+
+## Living Report Invariant
+- Applied patches create pre-apply `.bak` snapshots in `.torusguard/snapshots/<run_id>/`.
+- Finding statuses transition in `security_report.md` to `APPLIED 🔵`.
+- Instant rollback available via `npx torusguard rollback`.
+
+## Execution Steps
+
+1. **Load Remediation Bundle:** Read `patch.diff` and metadata from active run directory.
+2. **Audit Patch Invariants:** Run `python .torusguard/scripts/diff_guard.py <patch.diff>`.
+3. **Create Rollback Backup:** Copy target file to `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<filename>.bak`.
+4. **Apply Minimal Diff:** Execute precise surgical edit using `replace_file_content` or `patch`.
+5. **Assert Syntax & Integrity:** Check that modified file compiles cleanly without syntax errors.
+6. **Log Application Ledger:** Record timestamp, original SHA-256, and patched SHA-256 in `apply-log.json`.
+
+---
+
+## Failure Recovery
+
+- **Syntax Error After Patch:** Instantly revert target file from `.bak` backup snapshot.
+- **Merge / Context Conflict:** Re-run `/torusguard harden` to regenerate diff against latest disk lines.
+- **Missing Backup File:** Do not apply patch if backup copy cannot be written.
+- **Halt Trigger:** Abort if git working tree is dirty on conflicting lines.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never apply code changes without creating an exact pre-apply rollback backup first.
+- ❌ Never touch files not explicitly listed in the approved `patch.diff`.
+- ✅ Always verify syntax compilation immediately after modifying source files.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🚀 TorusGuard Patch Application
+- **Finding Addressed:** `TG-XXX-HASH`
+- **File Patched:** `src/path/to/file.py`
+- **Rollback Backup:** `.torusguard/runs/<run_id>/.torusguard/snapshots/<run_id>/<file>.bak`
+- **Churn Applied:** +[Additions] / -[Deletions] lines
+- **Syntax Check:** PASSED (clean compile)
+- **Status:** APPLIED — run `/torusguard recheck` to verify fix
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard recheck` to perform differential audit on the modified file.
+2. Run test suites to verify that business logic and regressions remain intact.

package/skills/torusguard/payload/workflows/torusguard-audit.md

@@ -0,0 +1,105 @@
+---
+description: Static security AST scanning, stable line-shift invariant fingerprinting, root-cause clustering, and 0-100 confidence scoring.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.4.0
+agent: auditor
+lifecycle-phase: Phase 2 (Static Audit & Clustering)
+required-skills:
+  - torusguard-audit
+scripts-binding:
+  - .torusguard/scripts/audit_runner.py
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# /torusguard audit — Static Security Code Scan & Clustering
+
+$ARGUMENTS
+
+---
+
+## Objective
+Static security AST scanning, stable fingerprinting, root-cause clustering, throughput telemetry, and 0-100 scoring.
+
+Supported CLI flags:
+- `npx torusguard audit [--target <dir>]` : Specify project root directory
+- `npx torusguard audit --watch` / `-w` : Continuous watch mode, re-scanning on file change
+- `npx torusguard audit --sarif` : Automatically export OASIS SARIF v2.1.0 log
+- `npx torusguard audit --severity <critical|high|medium|low>` : Floor filter for findings
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect workspace prerequisites before launching static audit:
+1. **Init State (`torusguard.json`):** Assert repository is initialized.
+2. **Active Rules (`rules/active/`):** Confirm rule definitions exist.
+3. **Exclusions:** Assert `node_modules/`, `.venv/`, `dist/`, `.git/` are skipped.
+4. **Run Folder:** Allocate isolated folder in `.torusguard/runs/`.
+5. **Syntax Check:** Check for syntax errors before parsing ASTs.
+
+---
+
+## When to Use /torusguard audit
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| First-time scan of repository or new branch | Run `/torusguard audit` |
+| Pre-commit review and PR security checks | Run `/torusguard audit` |
+| Uninitialized project | Run `/torusguard init` first |
+| Live endpoint or runtime probing | Run `/torusguard web-validate` |
+| Differential check after patch | Run `/torusguard recheck` |
+
+---
+
+## Living Report Invariant
+- Audit discoveries automatically synchronize to `security_report.md` at workspace root.
+- Findings transition into `OPEN 🔴` status with stable invariant fingerprints.
+
+## Execution Steps
+
+1. **Allocate Run Folder:** Run `python .torusguard/scripts/run_manager.py create audit`.
+2. **Scan Codebase ASTs:** Match active rules against source trees.
+3. **Compute Stable Fingerprints:** Hash AST context to produce stable IDs.
+4. **Cluster Root Causes:** Group findings sharing identical sinks.
+5. **Score Confidence (0–100):** Run `python .torusguard/scripts/finding_scorer.py --run <run_dir>`.
+6. **Emit Artifacts:** Write `findings.md`, `findings.json`, and `summary.md`.
+
+---
+
+## Failure Recovery
+
+- **Zero Rules Active:** Re-run `/torusguard init` to activate rules.
+- **AST Parse Error:** Log syntax error on malformed file, skip, and continue.
+- **Scorer Failure:** Ensure Python 3.10+; verify finding JSON structure.
+- **Halt Trigger:** Abort if run folder cannot be allocated or disk write fails.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never invent finding IDs without AST line hashing.
+- ❌ Never flag test fixtures as critical security flaws.
+- ✅ Always calculate scores using `.torusguard/scripts/finding_scorer.py`.
+
+---
+
+## Output Card Format
+
+```markdown
+### 🔎 TorusGuard Static Audit Results
+- **Run ID:** `run-YYYYMMDD-HHMMSS-audit`
+- **Files Scanned:** [Count] source files
+- **Total Findings:** [Count] ([Critical] Critical, [High] High)
+- **Root Cause Clusters:** [Count] architectural issues
+- **Confidence:** [Score]/100
+- **Artifact:** `.torusguard/runs/<run_id>/findings.md`
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard verify` to validate exploitability and review evidence.
+2. Run `/torusguard harden` to generate minimal surgical remediation plans.